IDC_protected[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
IDC_protected.exe
Size 16.8MB
Sample261029-vjk4csds5x
SHA256 54396de4d32027398909e424b528106534ff0c2b780d127af37c84b2de480e39
MD5 9584a0361e4783d25a03f2af190327da
SHA1 e1f947826c0c882369bcf2f2180296c567957a8c
SHA512 0885a45e7dc7aed20305e5b8a597d123c9eb40c77135d257584548ed7d7b09393c4495c686cb33e59de38f45a7e1456f9a779c55684133721bb37015d4569273
SSDEEP 196608:C5ywTnL4eVWvgEbx1MYt2O9W/MTp0IlB5bhi7pZ:yyiRWcU00TpJhVi7p
TLSH
T12C079EE320C226DEC816C57E8753FA3FDA4F71374A36E4E3A198B1665927C403A58F19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IDC_protected.exe

File Explorer

IDC_protected.exe

.exe 16.8MB

IDC_protected.exe

IMPHASH 0207106ff2a27918e123a181eda415b7
SHA256 54396de4d32027398909e424b528106534ff0c2b780d127af37c84b2de480e39
MD5 9584a0361e4783d25a03f2af190327da
SHA1 e1f947826c0c882369bcf2f2180296c567957a8c
SHA512 0885a45e7dc7aed20305e5b8a597d123c9eb40c77135d257584548ed7d7b09393c4495c686cb33e59de38f45a7e1456f9a779c55684133721bb37015d4569273
SSDEEP 196608:C5ywTnL4eVWvgEbx1MYt2O9W/MTp0IlB5bhi7pZ:yyiRWcU00TpJhVi7p
TLSH
T12C079EE320C226DEC816C57E8753FA3FDA4F71374A36E4E3A198B1665927C403A58F19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

729584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteFile GetDriveTypeA GetVolumeInformationA WaitForSingleObject OpenProcess MultiByteToWideChar GetFileAttributesA Process32NextW K32GetModuleBaseNameW CreateFileA Process32FirstW GetCurrentProcess IsWow64Process GetComputerNameA GetModuleFileNameA GetExitCodeProcess OpenThread GetTickCount SetThreadContext VirtualFreeEx ReadProcessMemory VirtualAllocEx GetProcAddress GetThreadContext VirtualProtectEx CreateThread CloseHandle LoadLibraryA GetLastError Sleep GetExitCodeThread CreateToolhelp32Snapshot ResumeThread SuspendThread GetCurrentThreadId Thread32First Thread32Next GetProcessId RtlAddFunctionTable GetSystemInfo InitializeCriticalSection SetEndOfFile WriteConsoleW HeapSize CreateFileW GetFileAttributesExW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP VirtualProtect WriteProcessMemory GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers WaitForSingleObjectEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree WideCharToMultiByte LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime GetTickCount64 GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleA GetFileSizeEx ReadFile GlobalMemoryStatusEx GetDiskFreeSpaceExA GetCurrentThread GlobalFree CreateProcessW Process32First Process32Next RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType SetFilePointerEx RtlUnwind

user32

GetWindow GetWindowThreadProcessId MessageBoxA ReleaseDC GetDC GetSystemMetrics EnumDisplayDevicesA PostThreadMessageW IsWindowVisible GetTopWindow GetWindowTextA

advapi32

RegSetValueExA CryptReleaseContext CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextA GetUserNameA LookupPrivilegeValueA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExA RegCreateKeyExA SystemFunction036 OpenProcessToken RegOpenKeyExA RegDeleteValueA

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CreateStreamOnHGlobal CoUninitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear

ws2_32

setsockopt ntohs closesocket WSAStartup

iphlpapi

GetAdaptersInfo GetTcpTable2

gdiplus

GdipSaveImageToStream GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage

winhttp

WinHttpGetIEProxyConfigForCurrentUser

gdi32

DeleteDC DeleteObject BitBlt CreateCompatibleDC CreateCompatibleBitmap SelectObject

Name

.text

Size

1009KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

11.3MB

Virtual Size

11.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

IDC_protected.exe

kernel32

user32

advapi32

ole32

oleaut32

ws2_32

iphlpapi

gdiplus

winhttp

gdi32

generic